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This talk presents the latest results of an ongoing study of computer- 
aided design of airplane control systems, which is based on satisfying 
requirements on multiple objectives. Constrained minimization algorithms 
are used, with the design objectives in the constraint vector [1] . We 
briefly review the concept of Pareto optimality and show how an experienced » 

designer can use it to find designs which are well-balanced in all objec- i 

tives [2,3]. Then we will discuss the problem of finding designs which are 
insensitive to uncertainty in system parameters, introducing a probabil- 
istic vector definition of sensitivity which is consistent with the ♦ 

deterministic Pareto optimal problem [4] . Insensitivity is important in m 

any practical design, but it is particularly important in the design of 
feedback control systems , since it is considered to be the most important 
distinctive property of feedback control . Methods of tradeoff between 
deterministic and stochastic-insensitive ( SI) design are described , and 
tradeoff design results are presented for the example of a Shuttle lateral 
stability augmentation system. This example is used because careful 
studies have been made of the uncertainty in Shuttle aerodynamics [5] . 

Finally, since accurate statistics of uncertain parameters are usually not 
available, the effects of crude statistical models on SI designs are 
examined . 


OUTLINE 


. REVIEW PARETO-OPTIMAL MULTIOBJECTIVE DETERMINISTIC AND 
STOCHASTIC-INSENSITIVE (SI) DESIGN. 

. FORMULATE METHODS OF TRADEOFF BETWEEN DETERMINISTIC AND 
STOCHASTIC-INSENSITIVE DESIGN. 

. DISCUSS TRADEOFF DESIGN RESULTS FOR SHUTTLE LATERAL STABILITY 
AUGMENTATION SYSTEM EXAMPLE. 

. EXAMINE EFFECTS OF INACCURATE STATISTICAL MODELS ON 
STOCHASTIC-INSENSITIVE DESIGN. 
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MULTIOBJECTIVE DESIGN BY CONSTRAINED MINIMIZATION 


The Pareto-optimal formulation of multiobjective design is not an 
optimization method in the usual sense, since it does not determine a 
unique solution. Pareto-optimal solutions comprise that portion of the 
boundary of the achievable domain which is noninferior to all others in 
the sense that every other solution must be worse in at least one 
objective. In the literature on multiobjective optimization it is 
generally assumed that some higher-level "decision maker’s" logic exists 
which can lead to an optimal solution. We assume, to the contrary, that no 
optimal solution exists for practical multiobjective design problems. Our 
Pareto-optimal algorithm is a valuable tool for the designer, since it 
enables the computer to calculate example Pareto-optimal solutions using a 
constrained minimization algorithm. However, the quality of the design 
depends on critical decisions made by the designer, who must choose the 
objective functions and values of associated scaling parameters which lead 
to solutions which are well-balanced in the disparate objectives, control 
the tradeoff iterations, and choose the final design. Rather than seeking 
some undefinable optimization index for complex systems, the design process 
is based on whatever computable objectives the designer considers 
important, with consideration of computational cost subordinated to the 
designer’s judgment. 


• PARETO-OPTIAWL FORMULATION 
. THERE IS NO OPTIMAL SOLUTION 

• COMPUTER CALCULATES EXAMPLE PARETO-OPTIMAL SOLUTIONS USING 
CONSTRAINED MINIMIZATION ALGORITHM 

• DESIGNER INTERACTION IS ESSENTIAL 

• CHOOSES AND SCALES OBJECTIVES 

• CONTROLS TRADEOFF ITERATIONS 

• CHOOSES FINAL DESIGN 


DETERMINISTIC PARETO-OPTIMAL ALGORITHM 


In this figure we present the constrained minimization formulation 
which leads to the example Pareto-optimal designs. Let z be the vector 
of design variables, n a scalar dummy variable, and f(z) the vector of 
objective functions, and let g(z) < 0 represent a vector of auxilliary 
constraints. Then for arbitrary vectors a and b (with b- > 0) 
solution of the constrained minimization problem on the first line leads to 
a design on the boundary of the achievable domain which is at least locally 
Pareto optimal. It is well known that this minimization problem is equiva- 
lent to the min-max problem on the second line. The particular solution 
obtained depends on the choice of a and b. Suppose the designer chooses 
for aj values of the objectives which he considers marginally accept- 
able, and another set of very desirable objectives, a^.. Then 
defining b = a - ap should yield a solution well balanced in the 
objectives, since a and ajj have been so chosen. This method, known 
as the "Goal Attainment Method" [6] , is illustrated in the sketch. The 
cross-hatched curve indicates the boundary of the achievable domain in 
objective space, and the part between the cross-hatched bars is the Pareto 
domain. At any Iteration the constraints on f are at (a + nb) . As h 
is minimized the constraints move toward the boundary, and the solution is 
forced to the deterministic optimal, fj)*, corresponding to the minimum 
Dd** The line joining fp* and a plays an Important role in the 
tradeoff formulations. 
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TRADEOFFS IN STOCHASTIC-INSENSITIVE DESIGN 


♦ 




♦ 


We now formulate the SI design algorithm and two tradeoff methods. 

The designer must specify a vector, y, of parameters with significant 
uncertainties and their probability distributions. Then the objective 
functions are f(z,y), and the stochastic sensitivity vector, s(z), is 
defined by the probabilities that specified requirements will be violated; 
i.e., that fj(z,y) where ±s a vector of requirement values. 


Since this definition is only useful when 


j 


> , it is desirable to 

j 


solve the deterministic problem first. Defining the Pareto-optimal SI 
design as that which minimizes the maximum sensitivity, the constrained 
minimization algorithm takes the form shown. Computational problems will 
be discussed later, but it is worth noting that insensitive design does not 
require accurate calculation of the probabilities. 


Both tradeoff methods use a scalar parameter to vary a vector 
inequality along the line of varying constraints shown on the sketch for 
the deterministic design. For fj)*, the SI designs must be very like 

the deterministic. Introducing a scalar parameter, and defining 

as in Method 1, » 1 gives deterministic-like solutions, and decreasing 

^ provides a sort of tradeoff procedure, with increasing emphasis on 
insensitive design. Method 2 is a more precise tradeoff. Here ^ is 
fixed at a va^ue giving insensitive design, and constraints on nominal 
objectives, f, are varied in a similar manner giving a tradeoff between 
sensitivity and nominal values of objectives. 

PARETOOPTIMAL STOCHASTIC-INSENSITIVE DESIGN (SI) 


DEFINE : s(z) 4 PROB lf(z,y) > f 1, f > f* = a + r^*b 

MIN n s.T. s(z) =n, g(z) = o 
z,n 

TRADEOFF METHODS IN SI DESIGN 

1. VARY f WITH SCALAR t. 

f (t ) = a + t n jb 

2. VARY CONSTRAINTS ON NOMINAL f-VALUES 

FIX f AND CONSTRAIN f(z,y) 4 T(z) ^ a + ? n!b 
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DESCRIPTION OF EXAMPLE CASE 


The example case is design of a lateral stability augmentation system 
(SAS) for Shuttle entry at M = 2.5. The linearized lateral response 
equations are 4th order. System states are sideslip angle (3), yaw 
rate (r), roll rate (p) and bank angle (<|>). Controls are aileron and 
rudder. The control law has 6 feedback gains (SAS design does not require 
bank angle feedback) and 2 feedforward gains from the pilot's stick input 
(•^ap) to the controls. The general design objective is to obtain rapid, 
stable roll response to the stick input, with small sideslip. This example 
was chosen because statistical uncertainties in Shuttle aerodynamics have 
been carefully studied, and at M = 2.5 these uncertainties have been 
found to cause unacceptable variation in lateral response using aerodynamic 
controls [5] . Nevertheless, in the example we use only aerodynamic con- 
trols. The design parameter vector z is comprised of the 8 gains. The 
uncertain parameter vector y contains all 6 aerodynamic control effec- 
tiveness coefficients and the 3 sideslip coefficients. (The — equation is 
kinematic and contains no aerodynamic effects.) Uncertainty in control 
effectiveness will clearly have a strong effect on control system design, 
and lateral response is sensitive to the sideslip coefficients. In 
stability axes the standard deviations of the 3 types of coefficients are 
fairly consistent, and approximate values are shown for sideslip (A^j), 
aileron (B^i) and rudder ( 6 ^ 2 ) coefficients. Rudder effectiveness is 
most uncertain. The y— statistics are considered gausslan and include 
correlation estimates. 


X = Ax + Bu, = (P, r, p, (p). = (6 , 6 ) 

9 r 


u=Kx + C 6 ,K = 

-Kii Kj 3 0 

c = 


ap’ 

K21 K22 K23 0 

f ^ 

1 

CM 


z-VECTOR: 8 CONTROL SYSTEM GAINS 


y-VECTOR: 6 CONTROL EFFECTIVENESS (Bj ) AND 3 SIDESLIP (p) 
DERIVATIVES (A.,) 

a -VALUES (M = 2.5): o(Ajj) == 14%, o(B.,) a 12%, 

o(B.„) ~ 20% 
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DESIGN OBJECTIVES FOR SHUTTLE LATERAL SAS 


In this study, 11 deterministic design objectives are considered. 
Generally, these are based on military handling-qualities requirements for 
large transports. Stability is a basic requirement, and the 4 character- 
istic roots must be considered separately because the requirements in the 
various modes differ. The bank angle achieved in 6 seconds is the speed of 
response objective. Decoupling of the rolling motion from yaw-sideslip is 
achieved by keeping the peak sideslip small and ^ ratio of 

coefficients in the roll transfer function, near unity. For the Shuttle, 
small sideslip is also a heat-load requirement. It is always desirable to 
keep control effort small. Since the natural stability of the Shuttle is 
inadequate, it is clear that saturation in control deflection must be 
avoided. Rate saturation can lead to violent nonlinear instability. 
Therefore, the obj ectives of minimizing the peak control deflections and 
rates are included • Finally, the sensitivities of the 11 obj ectives, as 
previously defined , are also included as obj ectives . Although the 
functions f(z,y) are nonlinear in y, the stochastic sensitivities were 
first calculated using a linear-gaussian assumption. These probabilities 
were checked using a Monte Carlo program, and all but the peak value 
probabilities were acceptably accurate. Acceptable accuracy was obtained 
by replacing the probability of violation for the maximum peak by the worst 
probability for any pair of peaks, using a bivariate gaussian routine. 

These approximate probabilities are used as the sensitivity functions in 
the tradeoff studies . 

CATEGORY 


DETERMINISTIC. fj(z): 

STABILITY 
SPEED OF RESPONSE 
DECOUPLING 
CONTROL EFFORT 


OBJECTIVE 


CHARACTERISTIC ROOTS 
BANK ANGLE IN 6 SECONDS 
PEAK SIDESLIP AND 


2 , 2 
(0,^ I (jO. 

d 


(P 

PEAK MAGNITUDES AND RATES 


STOCHASTIC SENSITIVITIES, Sj(z): 

PROBABILITIES OF VIOLATING 

f-REQUIREMENTS PRyOB Ifj(z.y) > fJ 


TRADEOFF VARYING 


This figure shows how the sensitivity of the control system varies for 
the simpler tradeoff method, varying the value of The 4 solid curves 

give Monte Carlo results for SI designs with values at ^=0, .2, .4 
and .6. The Monte Carlo method uses the nonlinear objective functions, so 
that these probabilities are a more realistic estimate of the sensitivities 
obtainable using the linear-gaussian approximation in the SI program. 
Decreasing values of design x give designs with more emphasis on insensi- 
tivity. The heavy do^ on each curve shows the Monte Carlo sensitivity at 
the design value of f. Since the probability of violation depends on 
the curve shows the sensitivity variation with 'f) to give a more complete 
picture of the sensitivity properties. Each curve can be thought of as a 
sort of vector cumulative distribution function, showing how the worst 
Pj increases from 0 to 1 as ^ increases. The curves are not smooth, 
because different Pj become worst as ^ varies. For comparison, the 
calculated optimal sensitivities and the Monte Carlo sensitivity values for 
the deterministic design are also shown. Although the Monte Carlo sensi- 
tivities for the 4 SI designs are much larger than the calculated values, 
comparison with the deterministic results shows that the SI designs are an 
order of magnitude less likely to have bad values of the objective 
functions. The usefulness of the probability approximation appears 
questionable for desi^ 4 ^ < 0.4. For example, at 0 the Monte Carlo 

^nsitivity for the x = 0 design is somewhat larger than those for the 
^ — .2 or .4 designs. Nevertheless, it is clear that the approximation is 
adequate to yield very significant decreases in sensitivity for SI designs 
compared to deterministic designs. 


PROBABILITY 

OF 

VIOLATION 
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VARIATION OF SI DESIGNS WITH 


It is interesting to examine how important properties of the design 
vary as ^ varies from near unity (deterministic-like designs) to lower 
values, with increasing emphasis on insensitivity. The variation of 
< 4 typical control system gains is shown on the left, and the nominal values 

*• of 3 typical objectives and their standard deviations on the right. There 

are clearly significant changes in design properties in the transition from 
deterministic designs to those emphasizing low sensitivity. However, as 
> noted in the previous figure, there seems little significant change in gains 

- or other system properties in designs for ^<0.4. As seen on the right, 

the main tradeoff penalty in nominal objectives for decreased sensitivity 
i^s loss of speed of response, as indicated by the bank angle at 6 seconds, 
((>(6) . Typical of the other objectives are the oscillatory damping ratio, 
which is relatively unchanged, and the damping in roll, > which 

increases. Note that 2 of the standard deviations decrease for 'the insen- 
sitive designs, but Oy^ actually increases. This is permitted because 
of the large Increase in I^rI* Th® computer finds gains to meet the 
varying probability constriinis, with freedom to use whatever combinations 
of f-values and o-values are required. 
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TRADEOFF VARYING CONSTRAINTS ON f 

This figure presents Monte Carlo results of the more precise tradeoff 
between insensitivity and nominal values of objectives. Starting with the 
SI design at t = 0 as the unconstrained design emphasizing insensitivity 
increasingly stringent constraints are Imposed on the nominal values by 
varying x in f(z) ^ a + xrijj*b. The probability of violation for 
the constrained designs is shown in the solid_curves. Although this method 
gives more precise control of the values of fj obtained in each SI 
design, t^is set of solutions seems similar to the set obtained by simply 
varying f • In the tradeoff varying there was a significant increase 
m the probability of violations at low between designs at ^^x^^ 
and X = .6. Here the corresponding increase in sensitivity (i.e., the 
probability of bad objective values) occurs between the designs for x= .6 
and X = .8. In problems where the probabilities can be calculated accu- 
rately (probabilistic design rather than insensitive design), this more 
precise method might be preferred, in spite of the added computational 
burden of adding the hard constraints. Also, there is a certain logical 
appeal to constraining the nominal objectives to good values while minimiz- 
ing the probability that the objectives will be worse than marginally 
acceptable. For our applications, however, accurate statistics are not 
obtainable, and the simpler method seems preferable. 
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EFFECTS OF CRUDE STATISTICAL MODEL ON SI DESIGN 








In practice, inaccuracy in f-statlstics resulting from the linear 
assumption is likely to be dominated by inaccuracy of the input values of 
the y— statistics . The statistics for the Shuttle example are more accurate 
and detailed than would usually be available for control system design. To 
investigate the effects of using a cruder estimate of the y-statistics on 
SI design, it was assumed that the sideslip, aileron and rudder 
coefficients had standard deviations equal to 15%, 15% and 20% of their 
nominal values, respectively, with no correlations. These crude statistics 
were used for SI design at 0.4, and this design is compared with the 

original desigi^ at ^=0.4 and the deterministic design. The figure 
shows Monte Carlo probabilities based on the Shuttle statistics. The 
curves are cumulative distribution functions for (|)(6), the objective which 
always shows a large penalty in expected value in SI designs, and peak 
6r» which is always critical in the calculated probabilities for the SI 
design. The simplified input statistics give an SI design which has the 
same basic properties and approximately the same sensitivity as obtained 
with the more accurate statistics. Although the effectiveness of the SI 
design does not seem to require an accurate statistical model, accurate 
calculation of the probabilities does require accuracy of the statistical 
model. For both SI designs, the simplified statistics predict much larger 
probabilities of violation than the accurate statistics, and it was found 
that almost all the discrepancy was caused by neglecting the y-correlations. 
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NOMINAL AND OFF-NOMINAL RESPONSES FOR 3 SI DESIGNS 


NO CONTROL LIMITING 


Although statistical distribution curves are the best way to compare 
designs for sensitivity to off-nominal parameters, simulated time histories 
of off-nominal responses are also useful. The Monte Carlo random set of 
responses for each control system was ranked using a weighted sura of viola- 
tions of desired objective values, and time histories of nominal and 5 
off-nominal responses at the 99th percentile for 3 SI designs are compared 
in this figure. The solid curves show the responses of the nominal system 
and the broken curves are the off-nominal responses. These cases are from 
the set shown in the tradeoff varying in which it was noted that there is 

a significant increase in the probability of bad objective values for 
design at 0.6. This increased sensitivity is shown here by the 

increase in scatter of the off-nominal responses for the design at 
^ = 0.6. The tendency for decreased nominal speed of response for the less 
sensitive designs is evident in the roll rate responses , p( t ) , and the 
tendency for large peak values of rudder and rudder rate in the off-nominal 
responses is evident in the 6|-(t) responses. In fact, the '^ = 0.6 
off-nominal responses all violate the rudder rate limit of 12°/sec. The 
next figure includes the control limits in the integration routine to show 
the destabilizing effect of rate limiting. 
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T = 0.4 




T = 0.6 




200 


NOMINAL AND OFF-NOMINAL RESPONSES FOR 3 SI DESIGNS 
INCLUDES CONTROL LIMITING 


This figure shows the importance of using peaks in control deflections 
and rates as design objectives when it is likely that control limiting may 
occur. Deflection limiting is dangerous when the uncontrolled airplane is 
unstable, but the nonlinear delays introduced by rate limiting can cause 
violent instabiUty in an inherently stable system, as shown in these 
responses for x = 0.6. Although the SI design method calculates only the 
linear responses, the designer can control the probability that the peaks 
will violate the control limits, as shown in the results for 4^= 0 
and 0.4. In this case the aj values for control peaks were chosen at 
the limiting values and the ap. values were 20% below the limits. 

The probabilities at x = 0 are'^ the probabilities that limiting will occur 
in the linear responses, and keeping these low implies that the probability 
of control-limiting instability will be low. 
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CONCLUDING REMARKS 


The Pareto-optimal stochastic insensitive design method defines a 
vector sensitivity which is related in a very natural way to a set of 
objectives chosen by an experienced designer. The designer must also make 
important decisions to formulate the constrained minimization algorithm for 
obtaining Pareto-optimal insensitive designs which are well balanced in the 
objectives and for trading off between insensitivity and nominal values. 

The designer, not the computer, makes the critical decisions which deter- 
mine the quality of the design. The effectiveness of the method depends on 
the designer's judgment, but this makes it easy for him to interact with 
the program. 

The main conclusions of this study are listed on the figure. The SI 
method yields control system designs with very significant decreases in 
sensitivity to parameter uncertainty. The effectiveness of the method does 
not depend on having an accurate statistical model. The tradeoff studies 
show that there are distinct differences between designs emphasizing insen- 
sitivity and deterministic designs. For example, there are large gain 
changes as emphasis on insensitivity increases. The two tradeoff methods 
are both effective in compromising between insensitivity and nominal values 
of objectives. Although the method utilizes only linear response calcula- 
tions, it produces designs which are less likely to encounter nonlinear 
control-limiting instabilities. Finally, in the example case, the main 
penalty for achieving insensitivity was decreased nominal speed of 
response. It will be interesting to see if further study shows this 
to be a general property of insensitive control system designs. 

STOCHASTIC-INSENSITIVE DESIGN GIVES A SIGNIFICANT DECREASE IN 
SENSITIVITY TO PARAMETER UNCERTAINTY IN SPITE OF INACCURACY OF 
CALCULATED PROBABILITIES. 

TRADEOFF STUDIES SHOW THAT SI DESIGNS ARE DISTINCUY DIFFERENT 
FROM DETERMINISTIC DESIGNS. 

SEVERAL EFFECTIVE METHODS WERE DEVELOPED FOR OBTAINING DESIGNS 
WHICH COMPROMISE BETWEEN INSENSITIVITY AND NOMINAL OBJECTIVE 
VALUES. 

INSENSITIVE DESIGN CAN BE ESPECIALLY EFFECTIVE WHEN CONTROL 
LIMITING IS A PROBLEM. 

IN THE SHUTTLE LATERAL SAS EXAMPLE, THE MAIN PENALTY FOR 
ACHIEVING INSENSITIVE DESIGNS WAS REDUCED VALUE OF NOMINAL 
RESPONSE SPEED. 
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